Security audit

Learning Review

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned, but it can silently rewrite important agent instruction, memory, and skill files on a schedule without clear approval or rollback controls.

Install only if you are comfortable with this skill changing persistent agent behavior. Configure any cron use as opt-in, require review of diffs before changes to AGENTS.md, TOOLS.md, SOUL.md, MEMORY.md, memory files, or skills, and keep backups or version control for learning and instruction files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The cron template authorizes autonomous modification of core agent context files (AGENTS.md, TOOLS.md, SOUL.md, memory/) based on weekly review output, which expands a learning-review function into persistent behavioral reconfiguration. Because these edits are to high-trust files and are instructed to run silently, reviewed notes can indirectly steer future agent behavior without explicit approval or change review.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The archive workflow performs structural rewriting of inline context files and moves learning notes, which can alter what the agent sees in future interactions and potentially discard or hide important context. This is risky because it changes trusted repository state beyond simple archival, and the compression heuristic is broad enough to permit unintended loss, drift, or injection of misleading summaries and pointers.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This template explicitly permits updating AGENTS.md or arbitrary skills based on reviewed learning notes, creating a pathway for untrusted or weakly vetted note content to modify operational instructions. In the skill context, this is especially dangerous because skills and agent guidance are high-authority control surfaces; silent mutation of them can permanently change behavior, permissions, or future decision-making.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill instructs the agent to modify and move workspace files, including rewriting inline files and archiving notes, without any explicit warning, confirmation step, or safety boundary. That creates a real integrity risk: an unattended or loosely triggered run could alter important project memory and skill files in ways the user did not intend, and file moves may make information harder to find or recover.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes cron-triggered execution for review modes that write reports and update core files, but it does not warn that these actions may occur automatically without active user review. Automatic file-writing and reorganization increases the chance of silent drift, accidental corruption of operational guidance files, and unexpected workspace changes over time.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs silent file-modifying archival actions ('安静执行，不推群'), meaning repository-altering behavior may occur without notifying the user or maintainers. Lack of visibility increases the chance that destructive or policy-relevant changes to context and notes go unnoticed, reducing the opportunity to detect mistakes or abuse.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Silent updates to AGENTS.md or skill files are particularly dangerous because they alter trusted instruction sources without warning, allowing persistent behavior changes outside normal review channels. In this skill's context, that makes the issue more severe than ordinary silent edits, since these files govern future agent conduct and can propagate subtle instruction drift.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.